From da64e69b577f2eef373baa739be049a943e0d7e4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Fri, 19 Feb 2021 15:45:22 +0100 Subject: [PATCH 01/31] logging-to-journald test added --- core/logging-to-journald/httpd.conf | 7 +++ core/logging-to-journald/main.fmf | 34 +++++++++++++ core/logging-to-journald/runtest.sh | 77 +++++++++++++++++++++++++++++ 3 files changed, 118 insertions(+) create mode 100644 core/logging-to-journald/httpd.conf create mode 100644 core/logging-to-journald/main.fmf create mode 100755 core/logging-to-journald/runtest.sh diff --git a/core/logging-to-journald/httpd.conf b/core/logging-to-journald/httpd.conf new file mode 100644 index 0000000..98111e8 --- /dev/null +++ b/core/logging-to-journald/httpd.conf @@ -0,0 +1,7 @@ +CustomLog journald:notice combined + + + ServerName vhost.localdomain:80 + LogFormat "foo@@%v@@%U@@bar" rhjournal + CustomLog journald:error rhjournal + diff --git a/core/logging-to-journald/main.fmf b/core/logging-to-journald/main.fmf new file mode 100644 index 0000000..bb19a8c --- /dev/null +++ b/core/logging-to-journald/main.fmf @@ -0,0 +1,34 @@ +summary: RFE-logging-to-journald +description: | + Bug summary: RFE: CustomLog should be able to use syslog as ErrorLog does + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1209162 +contact: Branislav Náter +component: +- httpd +test: ./runtest.sh +framework: beakerlib +require: +- library(httpd/http) +recommend: +- httpd +- curl +duration: 5m +enabled: true +tag: +- HttpdSclDone +- NoRHEL4 +- NoRHEL5 +- TIPfail +- Tier1 +tier: '1' +adjust: +- because: fixed in rhel-8.3 + enabled: false + when: distro < rhel-8 + continue: false +- enabled: false + when: distro ~< rhel-8.3 + continue: false +extra-nitrate: TC#0607562 +extra-summary: /CoreOS/httpd/Regression/bz1209162-RFE-logging-to-journald +extra-task: /CoreOS/httpd/Regression/bz1209162-RFE-logging-to-journald diff --git a/core/logging-to-journald/runtest.sh b/core/logging-to-journald/runtest.sh new file mode 100755 index 0000000..83375e0 --- /dev/null +++ b/core/logging-to-journald/runtest.sh @@ -0,0 +1,77 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/httpd/Regression/bz1209162-RFE-logging-to-journald +# Description: RFE-logging-to-journald +# Author: Joe Orton +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES=${PACKAGES:-"httpd"} + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm --all + rlImport httpd/http || rlDie + rlRun "CONF=$httpCONFDIR/conf.d/bz1209162.conf" + rlRun "cp httpd.conf $CONF" + rlRun "rlFileBackup /etc/hosts" + rlRun "echo 127.0.0.2 vhost.localdomain >> /etc/hosts" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "httpStart" + rlPhaseEnd + + rlPhaseStartTest + # Do all testing with a unique prefix so multiple runs aren't confused + rlRun "PFX=bz1209162_${RANDOM}_${RANDOM}" + # Check that something is logged + rlRun "curl http://localhost/${PFX}-test-alpha > /dev/null" 0 + rlRun "journalctl -u httpd -g ${PFX}-test-alpha > journal.alpha" + rlAssertGrep "GET /${PFX}-test-alpha" journal.alpha + + # Test that requests are only logged at the configured level + rlRun "curl http://localhost/${PFX}-test-beta > /dev/null" 0 + rlRun "journalctl -q -u httpd -g ${PFX}-test-beta -p crit > journal.crit" + rlRun "journalctl -q -u httpd -g ${PFX}-test-beta -p emerg > journal.emerg" + rlRun "journalctl -q -u httpd -g ${PFX}-test-beta -p notice > journal.notice" + rlAssertNotDiffer journal.crit /dev/null + rlAssertNotDiffer journal.emerg /dev/null + rlAssertGrep "GET /${PFX}-test-beta" journal.notice + + # Test for a different vhost config + rlRun "curl http://vhost.localdomain/${PFX}-test-gamma > /dev/null" 0 + rlRun "journalctl -u httpd -g ${PFX}-test-gamma -p err > journal.vhost" + rlAssertGrep "foo@@vhost.localdomain@@/${PFX}-test-gamma@@bar" journal.vhost + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + httpStop + rlFileRestore + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlRun "rm -f $CONF" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From e4186c9e21e44e3ec7f7091f1537ee9e766d02e3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Fri, 19 Feb 2021 16:09:54 +0100 Subject: [PATCH 02/31] Moving test to /core/ --- {Sanity/smoke => core/smoke-start}/main.fmf | 0 {Sanity/smoke => core/smoke-start}/runtest.sh | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename {Sanity/smoke => core/smoke-start}/main.fmf (100%) rename {Sanity/smoke => core/smoke-start}/runtest.sh (100%) diff --git a/Sanity/smoke/main.fmf b/core/smoke-start/main.fmf similarity index 100% rename from Sanity/smoke/main.fmf rename to core/smoke-start/main.fmf diff --git a/Sanity/smoke/runtest.sh b/core/smoke-start/runtest.sh similarity index 100% rename from Sanity/smoke/runtest.sh rename to core/smoke-start/runtest.sh From 2fac9fa853669561c1991e70f8246f6d8ae7368e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Fri, 19 Feb 2021 16:33:36 +0100 Subject: [PATCH 03/31] selinux-context test added --- core/selinux-context/TC#0336063.fmf | 9 +++++ core/selinux-context/main.fmf | 17 +++++++++ core/selinux-context/runtest.sh | 55 +++++++++++++++++++++++++++++ 3 files changed, 81 insertions(+) create mode 100644 core/selinux-context/TC#0336063.fmf create mode 100644 core/selinux-context/main.fmf create mode 100755 core/selinux-context/runtest.sh diff --git a/core/selinux-context/TC#0336063.fmf b/core/selinux-context/TC#0336063.fmf new file mode 100644 index 0000000..0e21dd8 --- /dev/null +++ b/core/selinux-context/TC#0336063.fmf @@ -0,0 +1,9 @@ +component: +- httpd +tag: +- HttpdSclDone +- TIPpass_FIPS +- TestParametrized +- Tier1 +extra-nitrate: TC#0336063 +extra-summary: /CoreOS/httpd/Regression/bz1052933-selinux-context diff --git a/core/selinux-context/main.fmf b/core/selinux-context/main.fmf new file mode 100644 index 0000000..337a4ab --- /dev/null +++ b/core/selinux-context/main.fmf @@ -0,0 +1,17 @@ +summary: check if httpd run with correct selinux context +description: '' +contact: Branislav Náter +component: +- httpd +test: ./runtest.sh +path: /Regression/bz1052933-selinux-context +framework: beakerlib +require: +- library(httpd/http) +recommend: +- httpd +duration: 5m +enabled: true +tier: '1' +extra-summary: /CoreOS/httpd/Regression/bz1052933-selinux-context +extra-task: /CoreOS/httpd/Regression/bz1052933-selinux-context diff --git a/core/selinux-context/runtest.sh b/core/selinux-context/runtest.sh new file mode 100755 index 0000000..b952342 --- /dev/null +++ b/core/selinux-context/runtest.sh @@ -0,0 +1,55 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/httpd/Regression/bz1052933-selinux-context +# Description: check if httpd run with correct selinux context +# Author: Ondrej Ptak +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2014 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES=${PACKAGES:-"httpd"} + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm --all + rlRun "rlImport httpd/http" 0 "Importing httpd library" || rlDie + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest + rlRun "ls -d -Z \$(rpm -ql $httpHTTPD) > files_context.log"\ + 0 "getting selinux context of rpm's files ($httpHTTPD)" + rlAssertGrep "httpd_exec_t.*/usr/sbin/httpd" files_context.log + rlAssertGrep "httpd_config_t.*/etc/httpd" files_context.log + rlAssertGrep "httpd_log_t.*/var/log/httpd" files_context.log + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From a961bfc6db3312c8225696636907e94a905648d5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Mon, 22 Feb 2021 10:45:49 +0100 Subject: [PATCH 04/31] path: /Regression/bz1052933-selinux-context removed from main.fmf --- core/selinux-context/main.fmf | 1 - 1 file changed, 1 deletion(-) diff --git a/core/selinux-context/main.fmf b/core/selinux-context/main.fmf index 337a4ab..456db88 100644 --- a/core/selinux-context/main.fmf +++ b/core/selinux-context/main.fmf @@ -4,7 +4,6 @@ contact: Branislav Náter component: - httpd test: ./runtest.sh -path: /Regression/bz1052933-selinux-context framework: beakerlib require: - library(httpd/http) From 7763fe2d6c4cd192ec8fea8290eeaa93d0cb9459 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Mon, 22 Feb 2021 17:34:56 +0100 Subject: [PATCH 05/31] journalctl --grep return value change --- core/logging-to-journald/runtest.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/core/logging-to-journald/runtest.sh b/core/logging-to-journald/runtest.sh index 83375e0..e386a75 100755 --- a/core/logging-to-journald/runtest.sh +++ b/core/logging-to-journald/runtest.sh @@ -53,8 +53,10 @@ rlJournalStart # Test that requests are only logged at the configured level rlRun "curl http://localhost/${PFX}-test-beta > /dev/null" 0 - rlRun "journalctl -q -u httpd -g ${PFX}-test-beta -p crit > journal.crit" - rlRun "journalctl -q -u httpd -g ${PFX}-test-beta -p emerg > journal.emerg" + # journalctl: return a non-zero EC when --grep returns no matches + # https://github.com/systemd/systemd/commit/6cda6774bdd90f8496d38dcd75d9be8a12660577 + rlRun "journalctl -q -u httpd -g ${PFX}-test-beta -p crit > journal.crit" 0,1 + rlRun "journalctl -q -u httpd -g ${PFX}-test-beta -p emerg > journal.emerg" 0,1 rlRun "journalctl -q -u httpd -g ${PFX}-test-beta -p notice > journal.notice" rlAssertNotDiffer journal.crit /dev/null rlAssertNotDiffer journal.emerg /dev/null From 3174ec218975e3f2f92904e867609b34991c6a73 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Wed, 9 Jun 2021 20:21:15 +0200 Subject: [PATCH 06/31] Merging fmf to one file --- integration/php-mariadb/TC#0296715.fmf | 16 ---------------- integration/php-mariadb/main.fmf | 3 +++ 2 files changed, 3 insertions(+), 16 deletions(-) delete mode 100644 integration/php-mariadb/TC#0296715.fmf diff --git a/integration/php-mariadb/TC#0296715.fmf b/integration/php-mariadb/TC#0296715.fmf deleted file mode 100644 index 03a9b53..0000000 --- a/integration/php-mariadb/TC#0296715.fmf +++ /dev/null @@ -1,16 +0,0 @@ -contact: Branislav Náter -component: -- httpd -enabled: true -tag: -- HttpdSclDone -- TIPpass -- TIPpass_FIPS -- Tier1 -adjust: -- because: BZ#1577237 - enabled: false - when: product == rhscl and distro <= rhel-6 - continue: false -extra-nitrate: TC#0296715 -extra-summary: /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test diff --git a/integration/php-mariadb/main.fmf b/integration/php-mariadb/main.fmf index c222a9a..0b5100c 100644 --- a/integration/php-mariadb/main.fmf +++ b/integration/php-mariadb/main.fmf @@ -17,6 +17,9 @@ recommend: - php-mysqlnd - mariadb-server duration: 5m +enabled: true +tag: +- Tier1 tier: '1' extra-summary: /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test extra-task: /CoreOS/httpd/Sanity/httpd-php-mysql-sanity-test From a7dda5340169fc31f73058ebf346a93464bf8760 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Wed, 9 Jun 2021 20:31:57 +0200 Subject: [PATCH 07/31] Fixing if statement --- integration/php-mariadb/runtest.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/integration/php-mariadb/runtest.sh b/integration/php-mariadb/runtest.sh index 913bd6a..281e1a5 100755 --- a/integration/php-mariadb/runtest.sh +++ b/integration/php-mariadb/runtest.sh @@ -54,7 +54,8 @@ rlJournalStart rlRun "rlImport mariadb55/basic" 0 "Import mariadb library" else rlRun "rlImport database/mariadb" 0 "Import mariadb library" - SERVICE=${mariadbServiceName} + SERVICE=${mariadbServiceName} + fi fi # install also php-mysql on rhel-6 (instead of php-mysqlnd on rhel-7) rlRun "rlImport php/utils" From bad20108ffc61a40e18a8d358c4c7d2f2ad266e5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Fri, 11 Jun 2021 09:29:13 +0200 Subject: [PATCH 08/31] Public test should use database/mariadb library --- integration/php-mariadb/runtest.sh | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/integration/php-mariadb/runtest.sh b/integration/php-mariadb/runtest.sh index 281e1a5..461acbc 100755 --- a/integration/php-mariadb/runtest.sh +++ b/integration/php-mariadb/runtest.sh @@ -50,12 +50,8 @@ rlJournalStart else DB="mariadb-server" # upstream beaker library on GitHub has different name - if ! rlIsFedora; then - rlRun "rlImport mariadb55/basic" 0 "Import mariadb library" - else - rlRun "rlImport database/mariadb" 0 "Import mariadb library" - SERVICE=${mariadbServiceName} - fi + rlRun "rlImport database/mariadb" 0 "Import mariadb library" + SERVICE=${mariadbServiceName} fi # install also php-mysql on rhel-6 (instead of php-mysqlnd on rhel-7) rlRun "rlImport php/utils" From adc4d2b81b45facb7d4c71fe4192c8d6df3bc29f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Wed, 24 Nov 2021 13:28:01 +0100 Subject: [PATCH 09/31] wget added to require --- core/smoke-start/main.fmf | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/core/smoke-start/main.fmf b/core/smoke-start/main.fmf index 42c4d06..de0743f 100644 --- a/core/smoke-start/main.fmf +++ b/core/smoke-start/main.fmf @@ -7,14 +7,13 @@ test: ./runtest.sh framework: beakerlib require: - library(httpd/http) +- wget recommend: - httpd - mod_ssl duration: 5m enabled: true tag: -- NoRHEL4 -- NoRHEL5 - Tier1 tier: '1' adjust: From 3d9e1dca353e9dd1b4c48f01b2743b934f533c16 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Thu, 2 Dec 2021 16:30:38 +0100 Subject: [PATCH 10/31] packages moved to require section --- integration/php-mariadb/main.fmf | 1 - 1 file changed, 1 deletion(-) diff --git a/integration/php-mariadb/main.fmf b/integration/php-mariadb/main.fmf index 0b5100c..c32f6ca 100644 --- a/integration/php-mariadb/main.fmf +++ b/integration/php-mariadb/main.fmf @@ -10,7 +10,6 @@ require: - library(database/mysql) - library(database/mariadb) - library(php/utils) -recommend: - httpd - php - php-zts From b761235346a473a03ad7f808cf235b67557f299f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Thu, 2 Dec 2021 17:22:46 +0100 Subject: [PATCH 11/31] php-zts moved to recommend --- integration/php-mariadb/main.fmf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/integration/php-mariadb/main.fmf b/integration/php-mariadb/main.fmf index c32f6ca..6e9a5fb 100644 --- a/integration/php-mariadb/main.fmf +++ b/integration/php-mariadb/main.fmf @@ -12,9 +12,10 @@ require: - library(php/utils) - httpd - php -- php-zts - php-mysqlnd - mariadb-server +recommend: +- php-zts duration: 5m enabled: true tag: From ba80602fc0ffbf7b20afcd4f6137d6b0237da3b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Mon, 6 Dec 2021 18:02:38 +0100 Subject: [PATCH 12/31] server-tokens test added --- core/server-tokens/main.fmf | 33 ++++++++++++++ core/server-tokens/runtest.sh | 83 +++++++++++++++++++++++++++++++++++ 2 files changed, 116 insertions(+) create mode 100644 core/server-tokens/main.fmf create mode 100755 core/server-tokens/runtest.sh diff --git a/core/server-tokens/main.fmf b/core/server-tokens/main.fmf new file mode 100644 index 0000000..4e876ed --- /dev/null +++ b/core/server-tokens/main.fmf @@ -0,0 +1,33 @@ +summary: httpd ServerTokens Full-Release +description: | + Bug summary: [RFE] Apache does not report patch level when scanned + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=240857 + + Test for BZ#240857 (httpd ServerTokens Full-Release) +contact: Branislav Náter +component: + - httpd +test: ./runtest.sh +path: /misc/bug240857 +framework: beakerlib +require: + - library(httpd/http) +recommend: + - httpd + - curl + - grep + - pyOpenSSL +duration: 5m +enabled: true +tag: + - HttpdSclDone + - Tier1 +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=240857 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=811714 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932442 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2029071 +extra-nitrate: TC#0078363 +extra-summary: /CoreOS/httpd/misc/bug240857 +extra-task: /CoreOS/httpd/misc/bug240857 diff --git a/core/server-tokens/runtest.sh b/core/server-tokens/runtest.sh new file mode 100755 index 0000000..7c5e130 --- /dev/null +++ b/core/server-tokens/runtest.sh @@ -0,0 +1,83 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/httpd/misc/bug240857 +# Description: Test for BZ#240857 (httpd ServerTokens Full-Release) +# Author: Joe Orton +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2007 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES="${PACKAGES:-httpd}" +REQUIRES="${REQUIRES:-curl}" + +rlJournalStart + rlPhaseStartSetup "Setup #1" + rlRun "rlImport httpd/http" 0 "Import httpd library" + rlAssertRpm --all + CONF="${httpCONFDIR}/conf/httpd.conf" + VERSION=`rpm -q --qf '%{VERSION}' $httpHTTPD` + RELEASE=`rpm -q --qf '%{RELEASE}' $httpHTTPD` + rlIsFedora && OS="Fedora" + rlIsCentOS && OS="CentOS" + rlIsRHEL && OS="Red Hat Enterprise Linux" + rlRun "rlFileBackup $CONF" + # Full-Release not present in Fedora + if ! rlIsFedora; then + grep ServerTokens $CONF || rlRun "echo 'ServerTokens Full-Release' >> $CONF" + else + rlRun "sed -i 's/^ServerTokens.*/ServerTokens Full-Release/' $CONF" + fi + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "httpStart" 0 "Start httpd" + rlPhaseEnd + + rlPhaseStartTest "Test #1" + rlRun "curl -s -D output http://localhost/" 0 "Getting Full Release Tokens" + cat output + + rlAssertGrep "^Server: Apache/$VERSION ($OS) (Release $RELEASE)" output + rlRun "httpStop" 0 "Stop httpd" + rlPhaseEnd + + rlPhaseStartSetup "Setup #2" + rlRun "sed -i 's/^ServerTokens.*/ServerTokens OS/' $CONF" + rlRun "httpStart" 0 "Start httpd" + rlPhaseEnd + + rlPhaseStartTest "Test #2" + rlRun "curl -s -D output http://localhost/" 0 "Getting default headers" + cat output + rlRun "tr -d '\r' < output | grep \"^Server: Apache/$VERSION ($OS)\$\"" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlRun "httpStop" 0 "Stop httpd" + rlRun "rlFileRestore" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From b039bd32544196a6d0621d57aff372398cdcc400 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Mon, 6 Dec 2021 18:14:42 +0100 Subject: [PATCH 13/31] path removed --- core/server-tokens/main.fmf | 1 - 1 file changed, 1 deletion(-) diff --git a/core/server-tokens/main.fmf b/core/server-tokens/main.fmf index 4e876ed..c0e79c9 100644 --- a/core/server-tokens/main.fmf +++ b/core/server-tokens/main.fmf @@ -8,7 +8,6 @@ contact: Branislav Náter component: - httpd test: ./runtest.sh -path: /misc/bug240857 framework: beakerlib require: - library(httpd/http) From 366b760d8ba0897f7b932e1b2ae296d1451f210c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Mon, 6 Dec 2021 18:34:55 +0100 Subject: [PATCH 14/31] Fedora doesn't support Full-Release --- core/server-tokens/runtest.sh | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/core/server-tokens/runtest.sh b/core/server-tokens/runtest.sh index 7c5e130..55e2c7e 100755 --- a/core/server-tokens/runtest.sh +++ b/core/server-tokens/runtest.sh @@ -54,20 +54,23 @@ rlJournalStart rlRun "httpStart" 0 "Start httpd" rlPhaseEnd - rlPhaseStartTest "Test #1" - rlRun "curl -s -D output http://localhost/" 0 "Getting Full Release Tokens" - cat output + # don't run Full-Release test on Fedora + if ! rlIsFedora; then + rlPhaseStartTest "Test Full-Release" + rlRun "curl -s -D output http://localhost/" 0 "Getting Full Release Tokens" + cat output - rlAssertGrep "^Server: Apache/$VERSION ($OS) (Release $RELEASE)" output - rlRun "httpStop" 0 "Stop httpd" - rlPhaseEnd + rlAssertGrep "^Server: Apache/$VERSION ($OS) (Release $RELEASE)" output + rlRun "httpStop" 0 "Stop httpd" + rlPhaseEnd + fi - rlPhaseStartSetup "Setup #2" + rlPhaseStartSetup "Setup OS" rlRun "sed -i 's/^ServerTokens.*/ServerTokens OS/' $CONF" rlRun "httpStart" 0 "Start httpd" rlPhaseEnd - rlPhaseStartTest "Test #2" + rlPhaseStartTest "Test OS" rlRun "curl -s -D output http://localhost/" 0 "Getting default headers" cat output rlRun "tr -d '\r' < output | grep \"^Server: Apache/$VERSION ($OS)\$\"" From 6843d3f686e200d5cb125553ebd40da10882555c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Tue, 7 Dec 2021 11:43:57 +0100 Subject: [PATCH 15/31] Better detection of OS --- core/server-tokens/runtest.sh | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/core/server-tokens/runtest.sh b/core/server-tokens/runtest.sh index 55e2c7e..757a24d 100755 --- a/core/server-tokens/runtest.sh +++ b/core/server-tokens/runtest.sh @@ -33,22 +33,23 @@ PACKAGES="${PACKAGES:-httpd}" REQUIRES="${REQUIRES:-curl}" rlJournalStart - rlPhaseStartSetup "Setup #1" + rlPhaseStartSetup "Setup Full-Release" rlRun "rlImport httpd/http" 0 "Import httpd library" rlAssertRpm --all CONF="${httpCONFDIR}/conf/httpd.conf" + rlRun "rlFileBackup $CONF" VERSION=`rpm -q --qf '%{VERSION}' $httpHTTPD` RELEASE=`rpm -q --qf '%{RELEASE}' $httpHTTPD` - rlIsFedora && OS="Fedora" - rlIsCentOS && OS="CentOS" - rlIsRHEL && OS="Red Hat Enterprise Linux" - rlRun "rlFileBackup $CONF" + OS=$(source /etc/os-release; echo ${NAME}) + rlIsRHEL 7 && OS="Red Hat Enterprise Linux" + # Full-Release not present in Fedora if ! rlIsFedora; then grep ServerTokens $CONF || rlRun "echo 'ServerTokens Full-Release' >> $CONF" else rlRun "sed -i 's/^ServerTokens.*/ServerTokens Full-Release/' $CONF" fi + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" rlRun "pushd $TmpDir" rlRun "httpStart" 0 "Start httpd" From 0d0837075c1ccb75d545fbb1ae923e3f29f49dbb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Thu, 31 Mar 2022 17:39:05 +0200 Subject: [PATCH 16/31] Check selinux for httpd-core --- core/selinux-context/runtest.sh | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/core/selinux-context/runtest.sh b/core/selinux-context/runtest.sh index b952342..8e1d060 100755 --- a/core/selinux-context/runtest.sh +++ b/core/selinux-context/runtest.sh @@ -40,8 +40,14 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest - rlRun "ls -d -Z \$(rpm -ql $httpHTTPD) > files_context.log"\ - 0 "getting selinux context of rpm's files ($httpHTTPD)" + # https://src.fedoraproject.org/rpms/httpd/pull-request/25 + if rlIsFedora '>=37'; then + rlRun "ls -d -Z \$(rpm -ql httpd-core) > files_context.log"\ + 0 "getting selinux context of rpm's files (httpd-core)" + else + rlRun "ls -d -Z \$(rpm -ql $httpHTTPD) > files_context.log"\ + 0 "getting selinux context of rpm's files ($httpHTTPD)" + fi rlAssertGrep "httpd_exec_t.*/usr/sbin/httpd" files_context.log rlAssertGrep "httpd_config_t.*/etc/httpd" files_context.log rlAssertGrep "httpd_log_t.*/var/log/httpd" files_context.log From d872e9b635ee7d78fd1a5633bf3de618b83d3d5f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Wed, 20 Apr 2022 10:25:38 +0200 Subject: [PATCH 17/31] contact moved to root main.fmf --- core/logging-to-journald/main.fmf | 1 - core/selinux-context/main.fmf | 1 - core/server-tokens/main.fmf | 1 - core/smoke-start/main.fmf | 1 - integration/php-mariadb/main.fmf | 1 - main.fmf | 2 ++ 6 files changed, 2 insertions(+), 5 deletions(-) create mode 100644 main.fmf diff --git a/core/logging-to-journald/main.fmf b/core/logging-to-journald/main.fmf index bb19a8c..2946566 100644 --- a/core/logging-to-journald/main.fmf +++ b/core/logging-to-journald/main.fmf @@ -2,7 +2,6 @@ summary: RFE-logging-to-journald description: | Bug summary: RFE: CustomLog should be able to use syslog as ErrorLog does Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1209162 -contact: Branislav Náter component: - httpd test: ./runtest.sh diff --git a/core/selinux-context/main.fmf b/core/selinux-context/main.fmf index 456db88..2720965 100644 --- a/core/selinux-context/main.fmf +++ b/core/selinux-context/main.fmf @@ -1,6 +1,5 @@ summary: check if httpd run with correct selinux context description: '' -contact: Branislav Náter component: - httpd test: ./runtest.sh diff --git a/core/server-tokens/main.fmf b/core/server-tokens/main.fmf index c0e79c9..0eb31c0 100644 --- a/core/server-tokens/main.fmf +++ b/core/server-tokens/main.fmf @@ -4,7 +4,6 @@ description: | Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=240857 Test for BZ#240857 (httpd ServerTokens Full-Release) -contact: Branislav Náter component: - httpd test: ./runtest.sh diff --git a/core/smoke-start/main.fmf b/core/smoke-start/main.fmf index de0743f..5842acf 100644 --- a/core/smoke-start/main.fmf +++ b/core/smoke-start/main.fmf @@ -1,6 +1,5 @@ summary: Simple check of httpd test page description: '' -contact: Branislav Náter component: - httpd test: ./runtest.sh diff --git a/integration/php-mariadb/main.fmf b/integration/php-mariadb/main.fmf index 6e9a5fb..3b968e9 100644 --- a/integration/php-mariadb/main.fmf +++ b/integration/php-mariadb/main.fmf @@ -1,6 +1,5 @@ summary: test fetching data from mysqldb/mariadb through php description: '' -contact: Branislav Náter component: - httpd test: ./runtest.sh diff --git a/main.fmf b/main.fmf new file mode 100644 index 0000000..8df2dbd --- /dev/null +++ b/main.fmf @@ -0,0 +1,2 @@ +# QE owner +contact: Branislav Náter From b9967f828f114fee5970e9a8c64b18946d839d13 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Wed, 20 Apr 2022 16:30:40 +0200 Subject: [PATCH 18/31] bz1069625-httpd-conf-uses-icon-bomb-gif-for-all-files-dirs test added --- .../bomb-gif-for-all-files-dirs/main.fmf | 28 ++++++ .../bomb-gif-for-all-files-dirs/runtest.sh | 88 +++++++++++++++++++ 2 files changed, 116 insertions(+) create mode 100644 mod_autoindex/bomb-gif-for-all-files-dirs/main.fmf create mode 100755 mod_autoindex/bomb-gif-for-all-files-dirs/runtest.sh diff --git a/mod_autoindex/bomb-gif-for-all-files-dirs/main.fmf b/mod_autoindex/bomb-gif-for-all-files-dirs/main.fmf new file mode 100644 index 0000000..fe6d0f0 --- /dev/null +++ b/mod_autoindex/bomb-gif-for-all-files-dirs/main.fmf @@ -0,0 +1,28 @@ +summary: httpd.conf uses icon bomb.gif for all files/dirs +description: | + Bug summary: httpd.conf uses icon bomb.gif for all files/dirs ending with core + + When mod_autoindex is active with FancyIndexing enabled, core dump files (and + no other) should be displayed with a bomb icon. Only binary files whose name is + 'core' or 'core.' should be treated as core dumps. +contact: jhouska@redhat.com +component: + - httpd +test: ./runtest.sh +framework: beakerlib +require: + - library(httpd/http) +recommend: + - httpd +duration: 5m +enabled: true +tag: + - NoTier +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1069625 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1196553 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2075406 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1170215 +extra-nitrate: TC#0463263 +extra-summary: /CoreOS/httpd/Regression/bz1069625-httpd-conf-uses-icon-bomb-gif-for-all-files-dirs +extra-task: /CoreOS/httpd/Regression/bz1069625-httpd-conf-uses-icon-bomb-gif-for-all-files-dirs diff --git a/mod_autoindex/bomb-gif-for-all-files-dirs/runtest.sh b/mod_autoindex/bomb-gif-for-all-files-dirs/runtest.sh new file mode 100755 index 0000000..5884995 --- /dev/null +++ b/mod_autoindex/bomb-gif-for-all-files-dirs/runtest.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/httpd/Regression/bz1069625-httpd-conf-uses-icon-bomb-gif-for-all-files-dirs +# Description: Test for BZ#1069625 (httpd.conf uses icon bomb.gif for all files/dirs) +# Author: Filip Holec +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2015 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES=${PACKAGES:-httpd} +REQUIRES=${REQUIRES:-} + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm --all + rlRun "rlImport httpd/http" 0 "import httpd/http library" || rlDie + + if rlIsRHEL 6 && [[ ${httpCOLLECTION} = 0 ]]; then + CONF="${httpCONFDIR}/conf/httpd.conf" + else + CONF="${httpCONFDIR}/conf.d/autoindex.conf" + fi + + rlRun "rlFileBackup --clean ${httpROOTDIR}" + TESTDIR="${httpROOTDIR}/mod_autoindex_test" + rlRun "mkdir ${TESTDIR}" 0 "Creating test directory" + rlLogInfo "Creating files in test directory" + for FILE in core score core. score. core.123 score.123 \ + coredump scoredump; do + rlRun "dd if=/dev/urandom of=${TESTDIR}/${FILE} bs=1k count=1" 0 \ + "Creating binary file ${TESTDIR}/${FILE}" + done + rlPhaseEnd + + rlPhaseStartTest "Check server configuration" + rlAssertGrep "AddIcon /icons/bomb\.gif /core" ${CONF} + if rlIsRHEL '>=7' || [[ ${httpCOLLECTION} = 1 ]]; then + rlAssertGrep "AddIcon /icons/bomb\.gif \*/core\.\*" ${CONF} + fi + rlAssertNotGrep "AddIcon /icons/bomb\.gif core" ${CONF} + rlPhaseEnd + + rlPhaseStartTest "Verify that bomb icons are used correctly" + rlRun "httpStart" 0 "Starting httpd" + rlRun -s "curl http://localhost/mod_autoindex_test/" 0 \ + "Downloading test directory index" + rlLogInfo "Files core, core. and core.123 should have bomb icon" + rlAssertGrep '/icons/bomb\.gif.*>core<' ${rlRun_LOG} + if rlIsRHEL '>=7' || [[ ${httpCOLLECTION} = 1 ]]; then + rlAssertGrep '/icons/bomb\.gif.*>core\.<' ${rlRun_LOG} + rlAssertGrep '/icons/bomb\.gif.*>core\.123<' ${rlRun_LOG} + fi + rlLogInfo "No other files should have bomb icon" + rlAssertNotGrep '/icons/bomb\.gif.*>score<' ${rlRun_LOG} + rlAssertNotGrep '/icons/bomb\.gif.*>score\.<' ${rlRun_LOG} + rlAssertNotGrep '/icons/bomb\.gif.*>score\.123<' ${rlRun_LOG} + rlAssertNotGrep '/icons/bomb\.gif.*>coredump<' ${rlRun_LOG} + rlAssertNotGrep '/icons/bomb\.gif.*>scoredump<' ${rlRun_LOG} + rlRun "httpStop" 0 "Stopping httpd" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rlFileRestore" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 3dce72e8c6c4ab80e7cc919adef7cc9dca36380d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Mon, 25 Apr 2022 14:36:17 +0200 Subject: [PATCH 19/31] Replacing bomb test with better version --- .../bomb-gif-for-all-files-dirs/main.fmf | 28 ------ .../bomb-gif-for-all-files-dirs/runtest.sh | 88 ------------------ .../main.fmf | 21 +++++ .../runtest.sh | 91 +++++++++++++++++++ .../segfault.c | 8 ++ 5 files changed, 120 insertions(+), 116 deletions(-) delete mode 100644 mod_autoindex/bomb-gif-for-all-files-dirs/main.fmf delete mode 100755 mod_autoindex/bomb-gif-for-all-files-dirs/runtest.sh create mode 100644 mod_autoindex/directory-named-core-gets-bomb-icon/main.fmf create mode 100755 mod_autoindex/directory-named-core-gets-bomb-icon/runtest.sh create mode 100644 mod_autoindex/directory-named-core-gets-bomb-icon/segfault.c diff --git a/mod_autoindex/bomb-gif-for-all-files-dirs/main.fmf b/mod_autoindex/bomb-gif-for-all-files-dirs/main.fmf deleted file mode 100644 index fe6d0f0..0000000 --- a/mod_autoindex/bomb-gif-for-all-files-dirs/main.fmf +++ /dev/null @@ -1,28 +0,0 @@ -summary: httpd.conf uses icon bomb.gif for all files/dirs -description: | - Bug summary: httpd.conf uses icon bomb.gif for all files/dirs ending with core - - When mod_autoindex is active with FancyIndexing enabled, core dump files (and - no other) should be displayed with a bomb icon. Only binary files whose name is - 'core' or 'core.' should be treated as core dumps. -contact: jhouska@redhat.com -component: - - httpd -test: ./runtest.sh -framework: beakerlib -require: - - library(httpd/http) -recommend: - - httpd -duration: 5m -enabled: true -tag: - - NoTier -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1069625 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1196553 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2075406 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1170215 -extra-nitrate: TC#0463263 -extra-summary: /CoreOS/httpd/Regression/bz1069625-httpd-conf-uses-icon-bomb-gif-for-all-files-dirs -extra-task: /CoreOS/httpd/Regression/bz1069625-httpd-conf-uses-icon-bomb-gif-for-all-files-dirs diff --git a/mod_autoindex/bomb-gif-for-all-files-dirs/runtest.sh b/mod_autoindex/bomb-gif-for-all-files-dirs/runtest.sh deleted file mode 100755 index 5884995..0000000 --- a/mod_autoindex/bomb-gif-for-all-files-dirs/runtest.sh +++ /dev/null @@ -1,88 +0,0 @@ -#!/bin/bash -# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/httpd/Regression/bz1069625-httpd-conf-uses-icon-bomb-gif-for-all-files-dirs -# Description: Test for BZ#1069625 (httpd.conf uses icon bomb.gif for all files/dirs) -# Author: Filip Holec -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2015 Red Hat, Inc. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGES=${PACKAGES:-httpd} -REQUIRES=${REQUIRES:-} - -rlJournalStart - rlPhaseStartSetup - rlAssertRpm --all - rlRun "rlImport httpd/http" 0 "import httpd/http library" || rlDie - - if rlIsRHEL 6 && [[ ${httpCOLLECTION} = 0 ]]; then - CONF="${httpCONFDIR}/conf/httpd.conf" - else - CONF="${httpCONFDIR}/conf.d/autoindex.conf" - fi - - rlRun "rlFileBackup --clean ${httpROOTDIR}" - TESTDIR="${httpROOTDIR}/mod_autoindex_test" - rlRun "mkdir ${TESTDIR}" 0 "Creating test directory" - rlLogInfo "Creating files in test directory" - for FILE in core score core. score. core.123 score.123 \ - coredump scoredump; do - rlRun "dd if=/dev/urandom of=${TESTDIR}/${FILE} bs=1k count=1" 0 \ - "Creating binary file ${TESTDIR}/${FILE}" - done - rlPhaseEnd - - rlPhaseStartTest "Check server configuration" - rlAssertGrep "AddIcon /icons/bomb\.gif /core" ${CONF} - if rlIsRHEL '>=7' || [[ ${httpCOLLECTION} = 1 ]]; then - rlAssertGrep "AddIcon /icons/bomb\.gif \*/core\.\*" ${CONF} - fi - rlAssertNotGrep "AddIcon /icons/bomb\.gif core" ${CONF} - rlPhaseEnd - - rlPhaseStartTest "Verify that bomb icons are used correctly" - rlRun "httpStart" 0 "Starting httpd" - rlRun -s "curl http://localhost/mod_autoindex_test/" 0 \ - "Downloading test directory index" - rlLogInfo "Files core, core. and core.123 should have bomb icon" - rlAssertGrep '/icons/bomb\.gif.*>core<' ${rlRun_LOG} - if rlIsRHEL '>=7' || [[ ${httpCOLLECTION} = 1 ]]; then - rlAssertGrep '/icons/bomb\.gif.*>core\.<' ${rlRun_LOG} - rlAssertGrep '/icons/bomb\.gif.*>core\.123<' ${rlRun_LOG} - fi - rlLogInfo "No other files should have bomb icon" - rlAssertNotGrep '/icons/bomb\.gif.*>score<' ${rlRun_LOG} - rlAssertNotGrep '/icons/bomb\.gif.*>score\.<' ${rlRun_LOG} - rlAssertNotGrep '/icons/bomb\.gif.*>score\.123<' ${rlRun_LOG} - rlAssertNotGrep '/icons/bomb\.gif.*>coredump<' ${rlRun_LOG} - rlAssertNotGrep '/icons/bomb\.gif.*>scoredump<' ${rlRun_LOG} - rlRun "httpStop" 0 "Stopping httpd" - rlPhaseEnd - - rlPhaseStartCleanup - rlRun "rlFileRestore" - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/mod_autoindex/directory-named-core-gets-bomb-icon/main.fmf b/mod_autoindex/directory-named-core-gets-bomb-icon/main.fmf new file mode 100644 index 0000000..181cff1 --- /dev/null +++ b/mod_autoindex/directory-named-core-gets-bomb-icon/main.fmf @@ -0,0 +1,21 @@ +summary: httpd.conf uses icon bomb.gif for core dir +description: |- + When mod_autoindex is active with FancyIndexing enabled, core dump files (and + no other) should be displayed with a bomb icon. Only binary files whose format + is application/x-coredump should be treated as core dumps. +component: + - httpd +test: ./runtest.sh +framework: beakerlib +require: + - library(httpd/http) +recommend: + - httpd + - gcc +duration: 5m +enabled: true +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2017144 +extra-nitrate: TC#0613209 +extra-summary: /CoreOS/httpd/Regression/bz2017144-directory-named-core-gets-bomb-icon +extra-task: /CoreOS/httpd/Regression/bz2017144-directory-named-core-gets-bomb-icon diff --git a/mod_autoindex/directory-named-core-gets-bomb-icon/runtest.sh b/mod_autoindex/directory-named-core-gets-bomb-icon/runtest.sh new file mode 100755 index 0000000..5aef2c2 --- /dev/null +++ b/mod_autoindex/directory-named-core-gets-bomb-icon/runtest.sh @@ -0,0 +1,91 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/httpd/Regression/bz2017144-directory-named-core-gets-bomb-icon +# Description: When mod_autoindex is active with FancyIndexing enabled, core dump files +# Author: Lubos Uhliarik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + + Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES=${PACKAGES:-httpd} +REQUIRES=${REQUIRES:-} + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm --all + rlRun "rlImport httpd/http" 0 "import httpd/http library" || rlDie + + CONF="${httpCONFDIR}/conf.d/autoindex.conf" + + rlRun "rlFileBackup --clean ${httpROOTDIR}" + TESTDIR="${httpROOTDIR}/mod_autoindex_test" + rlRun "mkdir ${TESTDIR}" 0 "Creating test directory" + rlLogInfo "Creating core files in test directory" + + rlRun "gcc segfault.c -o a.out" + rlRun "ulimit -c unlimited" + rlRun "./a.out" 139 + rlRun "coredumpctl dump -1 -o core" + + rlRun "cp core ${TESTDIR}/core" + rlRun "cp core ${TESTDIR}/secret" + + for FILE in score core. score. core.123 score.123 \ + coredump scoredump; do + rlRun "dd if=/dev/urandom of=${TESTDIR}/${FILE} bs=1k count=1" 0 \ + "Creating binary file ${TESTDIR}/${FILE}" + done + rlRun "mkdir -p ${TESTDIR}/coredir/core" + rlPhaseEnd + + rlPhaseStartTest "Verify that bomb icon is used correctly" + rlRun "httpStart" 0 "Starting httpd" + rlRun -s "curl http://localhost/mod_autoindex_test/" 0 \ + "Downloading test directory index" + rlLogInfo "Files core and secret should have a bomb icon" + rlAssertGrep '/icons/bomb\.gif.*>core<' ${rlRun_LOG} + rlAssertGrep '/icons/bomb\.gif.*>secret<' ${rlRun_LOG} + + rlLogInfo "No other files should have a bomb icon" + rlAssertNotGrep '/icons/bomb\.gif.*>score<' ${rlRun_LOG} + rlAssertNotGrep '/icons/bomb\.gif.*>score\.<' ${rlRun_LOG} + rlAssertNotGrep '/icons/bomb\.gif.*>score\.123<' ${rlRun_LOG} + rlAssertNotGrep '/icons/bomb\.gif.*>coredump<' ${rlRun_LOG} + rlAssertNotGrep '/icons/bomb\.gif.*>scoredump<' ${rlRun_LOG} + rlAssertNotGrep '/icons/bomb\.gif.*>coredir/<' ${rlRun_LOG} + + rlLogInfo "Directories should not have bomb icon" + rlRun -s "curl http://localhost/mod_autoindex_test/coredir/" 0 \ + "Downloading test directory index" + rlLogInfo "Directory core should not have a bomb icon" + rlAssertNotGrep '/icons/bomb\.gif.*>core/<' ${rlRun_LOG} + + rlRun "httpStop" 0 "Stopping httpd" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rlFileRestore" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/mod_autoindex/directory-named-core-gets-bomb-icon/segfault.c b/mod_autoindex/directory-named-core-gets-bomb-icon/segfault.c new file mode 100644 index 0000000..bc2970e --- /dev/null +++ b/mod_autoindex/directory-named-core-gets-bomb-icon/segfault.c @@ -0,0 +1,8 @@ +#include +#include + +int main(){ + int *segfault = NULL; + printf("Hello %d", *segfault); + return 0; +} From cc0818fdab205b20763700f14ec6849cda608784 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Mon, 25 Apr 2022 15:21:53 +0200 Subject: [PATCH 20/31] Adding missing '#' --- mod_autoindex/directory-named-core-gets-bomb-icon/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mod_autoindex/directory-named-core-gets-bomb-icon/runtest.sh b/mod_autoindex/directory-named-core-gets-bomb-icon/runtest.sh index 5aef2c2..1473260 100755 --- a/mod_autoindex/directory-named-core-gets-bomb-icon/runtest.sh +++ b/mod_autoindex/directory-named-core-gets-bomb-icon/runtest.sh @@ -25,7 +25,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - Include Beaker environment +# Include Beaker environment . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGES=${PACKAGES:-httpd} From 6b235279e325cfd0caa47483471bfa24f0f72d99 Mon Sep 17 00:00:00 2001 From: Iveta Cesalova Date: Tue, 28 Jun 2022 12:18:43 +0000 Subject: [PATCH 21/31] change fedora version --- core/selinux-context/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/selinux-context/runtest.sh b/core/selinux-context/runtest.sh index 8e1d060..f6df5ce 100755 --- a/core/selinux-context/runtest.sh +++ b/core/selinux-context/runtest.sh @@ -41,7 +41,7 @@ rlJournalStart rlPhaseStartTest # https://src.fedoraproject.org/rpms/httpd/pull-request/25 - if rlIsFedora '>=37'; then + if rlIsFedora '>=36'; then rlRun "ls -d -Z \$(rpm -ql httpd-core) > files_context.log"\ 0 "getting selinux context of rpm's files (httpd-core)" else From b8ffdae65c8f44ab149caf568ff578207262b59f Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Mon, 15 Aug 2022 08:12:40 +0100 Subject: [PATCH 22/31] Don't depend on a Fedora version test here, use httpd-core if the package is present. --- core/selinux-context/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/selinux-context/runtest.sh b/core/selinux-context/runtest.sh index f6df5ce..12652c9 100755 --- a/core/selinux-context/runtest.sh +++ b/core/selinux-context/runtest.sh @@ -41,7 +41,7 @@ rlJournalStart rlPhaseStartTest # https://src.fedoraproject.org/rpms/httpd/pull-request/25 - if rlIsFedora '>=36'; then + if rpm -q httpd-core >& /dev/null; then rlRun "ls -d -Z \$(rpm -ql httpd-core) > files_context.log"\ 0 "getting selinux context of rpm's files (httpd-core)" else From 4cb7228fb7920ec470f773f90524f517bbdae780 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Branislav=20N=C3=A1ter?= Date: Tue, 16 Aug 2022 10:58:08 +0200 Subject: [PATCH 23/31] Merge test metadata to main.fmf --- core/selinux-context/TC#0336063.fmf | 9 --------- core/selinux-context/main.fmf | 6 ++++++ 2 files changed, 6 insertions(+), 9 deletions(-) delete mode 100644 core/selinux-context/TC#0336063.fmf diff --git a/core/selinux-context/TC#0336063.fmf b/core/selinux-context/TC#0336063.fmf deleted file mode 100644 index 0e21dd8..0000000 --- a/core/selinux-context/TC#0336063.fmf +++ /dev/null @@ -1,9 +0,0 @@ -component: -- httpd -tag: -- HttpdSclDone -- TIPpass_FIPS -- TestParametrized -- Tier1 -extra-nitrate: TC#0336063 -extra-summary: /CoreOS/httpd/Regression/bz1052933-selinux-context diff --git a/core/selinux-context/main.fmf b/core/selinux-context/main.fmf index 2720965..e2f197f 100644 --- a/core/selinux-context/main.fmf +++ b/core/selinux-context/main.fmf @@ -11,5 +11,11 @@ recommend: duration: 5m enabled: true tier: '1' +tag: +- HttpdSclDone +- TIPpass_FIPS +- TestParametrized +- Tier1 +extra-nitrate: TC#0336063 extra-summary: /CoreOS/httpd/Regression/bz1052933-selinux-context extra-task: /CoreOS/httpd/Regression/bz1052933-selinux-context From 915769aea74898c6c74a2eb5cbcc1cf3e986e581 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 20 Dec 2022 09:56:25 +0000 Subject: [PATCH 24/31] Add smoke test for htcacheclean. --- core/smoke-htcacheclean/main.fmf | 18 +++++++++ core/smoke-htcacheclean/runtest.sh | 64 ++++++++++++++++++++++++++++++ 2 files changed, 82 insertions(+) create mode 100644 core/smoke-htcacheclean/main.fmf create mode 100755 core/smoke-htcacheclean/runtest.sh diff --git a/core/smoke-htcacheclean/main.fmf b/core/smoke-htcacheclean/main.fmf new file mode 100644 index 0000000..d71397a --- /dev/null +++ b/core/smoke-htcacheclean/main.fmf @@ -0,0 +1,18 @@ +summary: Smoke test for htcacheclean service +description: '' +component: +- httpd +test: ./runtest.sh +framework: beakerlib +require: +- library(httpd/http) +- httpd +duration: 1m +enabled: true +tag: +- Tier1 +tier: '1' +adjust: +- enabled: false + when: distro ~= rhel-4, rhel-5 + continue: false diff --git a/core/smoke-htcacheclean/runtest.sh b/core/smoke-htcacheclean/runtest.sh new file mode 100755 index 0000000..c5debb4 --- /dev/null +++ b/core/smoke-htcacheclean/runtest.sh @@ -0,0 +1,64 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh htcacheclean test +# Description: Smoke test of htcacheclean +# Author: Joe Orton +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES="${PACKAGES:-httpd}" +REQUIRES=${REQUIRES:-} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest + rlRun -l "systemctl preset htcacheclean" + rlRun -s -l "systemctl is-enabled htcacheclean" 1 + rlAssertGrep disabled $rlRun_LOG + + # Check for warning for missing [Install] + rlRun -s -l "systemctl enable htcacheclean" 0 "Enable htcacheclean service" + rlAssertNotGrep 'The unit files have no installation config' $rlRun_LOG + + rlRun -s -l "systemctl is-enabled htcacheclean" + rlAssertGrep enabled $rlRun_LOG + + rlRun "systemctl start htcacheclean" 0 "Start htcacheclean service" + rlRun "sleep 5" + rlRun "systemctl stop htcacheclean" 0 "Stop htcacheclean service" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalEnd +rlJournalPrintText From 6acb3b42bd61568370a8bd9697dd76ae825b4791 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Tue, 20 Dec 2022 14:14:18 +0000 Subject: [PATCH 25/31] Tweak adjust section to avoid running on RHEL < 10. --- core/smoke-htcacheclean/main.fmf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/smoke-htcacheclean/main.fmf b/core/smoke-htcacheclean/main.fmf index d71397a..c02f158 100644 --- a/core/smoke-htcacheclean/main.fmf +++ b/core/smoke-htcacheclean/main.fmf @@ -14,5 +14,5 @@ tag: tier: '1' adjust: - enabled: false - when: distro ~= rhel-4, rhel-5 + when: distro < rhel-10, centos-stream-10 continue: false From 244f7a98ef9a0cc44d1264d460b9f0eef50274da Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 13 Jan 2023 09:23:07 +0000 Subject: [PATCH 26/31] Add smoke test for httpd-init and mod_ssl/sscg dhparams handling bug. --- mod_ssl/check-httpd-init/main.fmf | 15 ++++++++ mod_ssl/check-httpd-init/runtest.sh | 53 +++++++++++++++++++++++++++++ 2 files changed, 68 insertions(+) create mode 100644 mod_ssl/check-httpd-init/main.fmf create mode 100755 mod_ssl/check-httpd-init/runtest.sh diff --git a/mod_ssl/check-httpd-init/main.fmf b/mod_ssl/check-httpd-init/main.fmf new file mode 100644 index 0000000..c28d72b --- /dev/null +++ b/mod_ssl/check-httpd-init/main.fmf @@ -0,0 +1,15 @@ +summary: Smoke test for httpd-init service +description: '' +component: +- httpd +test: ./runtest.sh +framework: beakerlib +require: +- library(httpd/http) +- httpd +- mod_ssl +duration: 1m +enabled: true +tag: +- Tier1 +tier: '1' diff --git a/mod_ssl/check-httpd-init/runtest.sh b/mod_ssl/check-httpd-init/runtest.sh new file mode 100755 index 0000000..e3894c8 --- /dev/null +++ b/mod_ssl/check-httpd-init/runtest.sh @@ -0,0 +1,53 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh htcacheclean test +# Description: Smoke test of htcacheclean +# Author: Joe Orton +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES="${PACKAGES:-httpd mod_ssl}" +REQUIRES=${REQUIRES:-} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport --all" 0 "Importing Beaker libraries" || rlDie + rlRun "rm -vf /dhparams.pem /etc/pki/tls/certs/localhost.crt /etc/pki/tls/private/localhost.key" + rlPhaseEnd + + rlPhaseStartTest + rlRun "systemctl start httpd" + rlAssertNotExists /dhparams.pem + rlAssertExists /etc/pki/tls/certs/localhost.crt /etc/pki/tls/private/localhost.key + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "systemctl stop httpd" + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalEnd +rlJournalPrintText From 9b92ad2f339f1068f27a55dbf0084d515b851312 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Fri, 13 Jan 2023 09:35:17 +0000 Subject: [PATCH 27/31] Fix test. --- mod_ssl/check-httpd-init/runtest.sh | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/mod_ssl/check-httpd-init/runtest.sh b/mod_ssl/check-httpd-init/runtest.sh index e3894c8..780336e 100755 --- a/mod_ssl/check-httpd-init/runtest.sh +++ b/mod_ssl/check-httpd-init/runtest.sh @@ -41,13 +41,12 @@ rlJournalStart rlPhaseStartTest rlRun "systemctl start httpd" rlAssertNotExists /dhparams.pem - rlAssertExists /etc/pki/tls/certs/localhost.crt /etc/pki/tls/private/localhost.key + rlAssertExists /etc/pki/tls/certs/localhost.crt + rlAssertExists /etc/pki/tls/private/localhost.key rlPhaseEnd rlPhaseStartCleanup rlRun "systemctl stop httpd" - rlRun "popd" - rlRun "rm -r $TmpDir" 0 "Removing tmp directory" rlPhaseEnd rlJournalEnd rlJournalPrintText From a8e29def37d0d8875f4d30ced2fabdb1fa565005 Mon Sep 17 00:00:00 2001 From: Gordon Messmer Date: Sun, 28 Jul 2024 23:04:09 -0700 Subject: [PATCH 28/31] Remove mysql from the php-mariadb test requirements because it conflicts with the mariadb requirement. --- integration/php-mariadb/main.fmf | 1 - 1 file changed, 1 deletion(-) diff --git a/integration/php-mariadb/main.fmf b/integration/php-mariadb/main.fmf index 3b968e9..6f5a6bd 100644 --- a/integration/php-mariadb/main.fmf +++ b/integration/php-mariadb/main.fmf @@ -6,7 +6,6 @@ test: ./runtest.sh framework: beakerlib require: - library(httpd/http) -- library(database/mysql) - library(database/mariadb) - library(php/utils) - httpd From 3e260a599eba65b21235b96b1b88b8315b8008dd Mon Sep 17 00:00:00 2001 From: Gordon Messmer Date: Sun, 28 Jul 2024 00:27:49 -0700 Subject: [PATCH 29/31] Examine the server process GOT for signs of tampering. --- Sanity/got-audit/Makefile | 45 ++++++++++++++++++++++++++++++++++ Sanity/got-audit/got-audit.gdb | 2 ++ Sanity/got-audit/main.fmf | 12 +++++++++ Sanity/got-audit/runtest.sh | 41 +++++++++++++++++++++++++++++++ 4 files changed, 100 insertions(+) create mode 100644 Sanity/got-audit/Makefile create mode 100644 Sanity/got-audit/got-audit.gdb create mode 100644 Sanity/got-audit/main.fmf create mode 100755 Sanity/got-audit/runtest.sh diff --git a/Sanity/got-audit/Makefile b/Sanity/got-audit/Makefile new file mode 100644 index 0000000..9c1c267 --- /dev/null +++ b/Sanity/got-audit/Makefile @@ -0,0 +1,45 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/httpd/Sanity/got-audit +# Description: Ensure pointers in the server process GOT match expected values +# Author: Gordon Messmer +# + +export TEST=/CoreOS/httpd/Sanity/got-audit +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile got-audit.gdb + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +-include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Gordon Messmer " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Ensure pointers in the server process GOT match expected values" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: httpd" >> $(METADATA) + @echo "Requires: httpd gdb-gef" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: yes" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: " >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/Sanity/got-audit/got-audit.gdb b/Sanity/got-audit/got-audit.gdb new file mode 100644 index 0000000..6661297 --- /dev/null +++ b/Sanity/got-audit/got-audit.gdb @@ -0,0 +1,2 @@ +gef config gef.disable_color True +got-audit --all diff --git a/Sanity/got-audit/main.fmf b/Sanity/got-audit/main.fmf new file mode 100644 index 0000000..552c5ef --- /dev/null +++ b/Sanity/got-audit/main.fmf @@ -0,0 +1,12 @@ +summary: Audit the GOT for signs of tampering +description: | + Pointers in the server process GOT will be checked to ensure that + each function pointer's value is within a shared object file + that exports a symbol of that name, and that no shared object + files export conflicting symbols. +contact: Gordon Messmer +require+: + - gdb-gef # needed to test got-audit +test: ./runtest.sh +framework: beakerlib + diff --git a/Sanity/got-audit/runtest.sh b/Sanity/got-audit/runtest.sh new file mode 100755 index 0000000..ce4902b --- /dev/null +++ b/Sanity/got-audit/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/httpd/Sanity/got-audit +# Description: Check pointers in the server process GOT for signs of tampering +# Author: Gordon Messmer +# + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlServiceStart httpd + rlRun "TestDir=\$(pwd)" + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + rlRun "auditfile=\$(mktemp --tmpdir=${TmpDir})" + rlPhaseEnd + + rlPhaseStartTest "Run GEF got-audit" + rlRun "SERVICE_PID=\$( systemctl show --property=MainPID httpd.service | cut -f2 -d= )" + rlRun "echo SERVICE_PID is '$SERVICE_PID'" + [ -n "$SERVICE_PID" ] || rlFail "No service pid was found" + rlRun "gdb-gef --pid '$SERVICE_PID' --command='$TestDir'/got-audit.gdb --batch > '$auditfile'" + # Basic test: ensure that at least one symbol is found in libc.so, + # to verify that the report looks plausible. + rlAssertGrep " : /.*/libc.so" "$auditfile" + # Ensure the got-audit did not report any errors + rlAssertNotGrep " :: ERROR" "$auditfile" + rlRun "cp '$auditfile' '$TMT_TEST_DATA'/got-audit.txt" + rlPhaseEnd + + rlPhaseStartCleanup + rlServiceRestore httpd + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 0e498dbd8ab778af6140236dfe2ede5b488743e3 Mon Sep 17 00:00:00 2001 From: Joe Orton Date: Wed, 5 Mar 2025 09:25:12 +0000 Subject: [PATCH 30/31] Upload the files_context.log for the SELinux test. --- core/selinux-context/runtest.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/core/selinux-context/runtest.sh b/core/selinux-context/runtest.sh index 12652c9..8119f7b 100755 --- a/core/selinux-context/runtest.sh +++ b/core/selinux-context/runtest.sh @@ -48,6 +48,7 @@ rlJournalStart rlRun "ls -d -Z \$(rpm -ql $httpHTTPD) > files_context.log"\ 0 "getting selinux context of rpm's files ($httpHTTPD)" fi + rlFileSubmit files_context.log rlAssertGrep "httpd_exec_t.*/usr/sbin/httpd" files_context.log rlAssertGrep "httpd_config_t.*/etc/httpd" files_context.log rlAssertGrep "httpd_log_t.*/var/log/httpd" files_context.log From 1d1d0fd2d5bfb01725cb065fd4886842d2965439 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Tue, 1 Apr 2025 09:02:48 -0700 Subject: [PATCH 31/31] Tweak selinux-context test to handle sbin merge We can't assume the existence of /usr/sbin/httpd any more; with the sbin merge, it may be /usr/bin/httpd . Let's decide which to look for by checking whether /usr/sbin is a symlink. Signed-off-by: Adam Williamson --- core/selinux-context/runtest.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/core/selinux-context/runtest.sh b/core/selinux-context/runtest.sh index 8119f7b..f0844b0 100755 --- a/core/selinux-context/runtest.sh +++ b/core/selinux-context/runtest.sh @@ -49,7 +49,12 @@ rlJournalStart 0 "getting selinux context of rpm's files ($httpHTTPD)" fi rlFileSubmit files_context.log - rlAssertGrep "httpd_exec_t.*/usr/sbin/httpd" files_context.log + # handle sbin merge by checking if /usr/sbin is a symlink + if test -L /usr/sbin; then + rlAssertGrep "httpd_exec_t.*/usr/bin/httpd" files_context.log + else + rlAssertGrep "httpd_exec_t.*/usr/sbin/httpd" files_context.log + fi rlAssertGrep "httpd_config_t.*/etc/httpd" files_context.log rlAssertGrep "httpd_log_t.*/var/log/httpd" files_context.log rlPhaseEnd